A decade-old flaw in the XRP Ledger’s payment engine forced its developers to break with a core governance norm this month, and the fallout has reopened a fight over whether the network is as decentralized as it claims to be.

The bug, an integer overflow that had sat in the code since 2015, could have let an attacker create spendable XRP beyond the ledger’s fixed supply. To fix it before the flaw became public knowledge, XRPL developers pushed an emergency patch that took effect immediately rather than going through the network’s standard two-week validator vote, the first deliberate bypass of that process since it was introduced more than ten years ago, according to Cointelegraph. That decision, and how it was communicated, is now the center of the dispute.

Key Takeaways

  • XRP Ledger developers shipped emergency patch xrpld 3.4.1 on Sept. 25, three days after a Sept. 22 bug bounty report, bypassing the network’s usual two-week validator vote for the first time since the amendment process launched more than a decade ago.
  • The bug, an integer overflow in the payment engine present since 2015, could have let an attacker mint spendable XRP beyond the ledger’s fixed supply by constructing hundreds of oversized offers and sending one payment that consumed them all.
  • XRPL Foundation says the vulnerability never actually created new XRP and that the decision to skip the normal vote was made jointly by the Foundation, RippleX, core developers and validators, not by any single party.
  • Cyber Capital founder Justin Bons argues the binaries-only release and pressure to upgrade undercut XRPL’s claim to be fully decentralized, a claim central to arguments that XRP isn’t a security.
  • Independent validator operator XRP Kuwait disputes that coordinated upgrades amount to centralized control, saying operators can reach the same conclusion independently without giving up their independence.

How an Overflow Bug Could Have Minted XRP

The vulnerability lived in how the payment engine totals up offers on XRPL’s built-in decentralized exchange. XRP balances are stored as 64-bit integers with a fixed maximum value; when a sum exceeded that ceiling, the calculation wrapped around to a much smaller number instead of failing, according to Cointelegraph.

An attacker could exploit this by placing hundreds of specially priced offers, each requesting an outsized amount of XRP, then sending a single payment that consumed all of them at once. The engine would credit every offer owner their full requested amount but charge the buyer only the wrapped, far smaller total. The gap between those two figures would be newly created, spendable XRP.

A second weakness compounded the risk, according to CoinsPress. XRPL already had a safeguard meant to prevent transactions from creating XRP out of nothing, but that check relied on the same type of arithmetic and could overflow the same way. Account-balance limits offered little backup protection either, since an attacker could spread the unauthorized XRP across multiple accounts. RippleX engineers reproduced the bug in a controlled environment and confirmed the extra XRP could be transferred, though developers found no evidence it was ever exploited on a live network.

The fix introduced checked arithmetic in the payment engine and widened the counter used for the supply invariant, closing both the original overflow and the backup check that shared its flaw, per CoinsPress. XRPL Foundation later clarified, as reported by PANews, that the bug never actually minted new XRP: total supply has stood at a fixed 100 billion since launch, with roughly 99.986 billion currently in circulation, and the flaw only ever had the potential to bypass that limit rather than having done so.

Breaking the Amendment Process to Patch It

XRPL’s normal path for protocol changes, called an amendment, requires support from more than 80% of trusted validators sustained for two consecutive weeks before it activates, according to CoinsPress. That process is public by design, which is exactly what made it unusable here.

Developers said in a Sunday X post that waiting for a standard amendment vote would have exposed the vulnerability’s location for weeks before any fix took effect, giving potential attackers ample time to study and weaponize it, according to Cointelegraph. Instead, the patch, released as xrpld version 3.4.1 on Sept. 25, took hold immediately on any server that installed it. PANews reported that the Foundation also noted ordinary payment transactions come nowhere near triggering the bug, since it requires hundreds of deliberately crafted operations, and that AI tools have made it faster for both attackers and security researchers to surface flaws like this one.

A Fight Over What “Decentralized” Means

The expedited release reignited questions about XRPL’s governance, a claim the network has used on its own website to describe itself as fully decentralized, a characterization that has figured into arguments that XRP is not a security, per Cointelegraph.

Cyber Capital founder Justin Bons said Thursday that marketing XRP to retail investors as decentralized amounts to “straight-up fraud,” pointing to the emergency release shipping as binaries only, with source code temporarily withheld and operators pressured to upgrade, according to Cointelegraph.

XRPL Foundation rejected the framing, saying no single party could have made the call to bypass the amendment process alone. The decision was reached jointly by the Foundation, RippleX, core developers and validators after assessing the bug’s severity, and every validator and node operator still chooses what software to run, the Foundation said. Making version 3.4.1 mandatory, it added, “only became required through a normal amendment vote with more than 80% validator support for two weeks,” since protocol changes still go through amendments. Independent validator operator XRP Kuwait pushed back on the centralization reading directly: “Coordination is not the same as control. Independent operators can assess a situation, communicate with one another, and reach the same conclusion without giving up their independence.”

The disagreement leaves an open question that this episode didn’t settle: whether a network built on independent validators can call an emergency, coordinated response “social consensus” without undercutting the decentralization it claims. The Foundation says it plans to strengthen formal verification, AI-driven adversarial testing and its bug bounty program going forward, per PANews, a response to how the flaw went undetected for more than a decade rather than to the governance question critics are still pressing.

Sources